WO2018075317A1 - Establishing secure sessions for stateful cloud services - Google Patents
Establishing secure sessions for stateful cloud services Download PDFInfo
- Publication number
- WO2018075317A1 WO2018075317A1 PCT/US2017/056239 US2017056239W WO2018075317A1 WO 2018075317 A1 WO2018075317 A1 WO 2018075317A1 US 2017056239 W US2017056239 W US 2017056239W WO 2018075317 A1 WO2018075317 A1 WO 2018075317A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- stateful
- host
- client device
- unique identifier
- client
- Prior art date
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/14—Session management
- H04L67/141—Setup of application sessions
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
- G06F21/33—User authentication using certificates
- G06F21/335—User authentication using certificates for accessing specific resources, e.g. using Kerberos tickets
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
- H04L63/062—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key distribution, e.g. centrally by trusted party
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0807—Network architectures or network communication protocols for network security for authentication of entities using tickets, e.g. Kerberos
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/50—Network services
- H04L67/56—Provisioning of proxy services
- H04L67/59—Providing operational support to end devices by off-loading in the network or by emulation, e.g. when they are unavailable
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/40—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/06—Authentication
- H04W12/068—Authentication using credential vaults, e.g. password manager applications or one time password [OTP] applications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/06—Authentication
Definitions
- the backend service When creating, editing or otherwise accessing content stored on the cloud, it may be desirable to have the backend service maintain all the information about that content. This is generally referred to as a stateful service. As the backend service maintains the information about the content, it may be desirable for a user to have access to the content in a secure manner regardless of the device they are using.
- aspects of the present disclosure relate to establishing a secure session between a client device and a stateful backend server or host.
- the client device can create, edit, or otherwise access content such as, for example, documents, applications, and other content, stored on the cloud, a cloud service or otherwise hosted by a backend server.
- content such as, for example, documents, applications, and other content
- an identity token associated with the client device, or a user of the client device is provided to an authorization service.
- an authorization token is generated.
- the authorization token includes a unique identifier associated with the client device.
- the unique identifier is used to generate the stateful host on a virtual machine.
- An internet protocol address associated with the stateful host is then determined.
- the internet protocol address is associated with the unique identifier to create a name-value pair.
- the name-value pair may then be used to establish the communication session between the client device and the stateful host.
- a system comprising a processor and a memory for storing instructions which, when executed by the processor, performs a method for establishing a communication session between a client device and a stateful host.
- This method includes receiving a unique identifier from the client device, the unique identifier being associated with a client identification token and a client authorization token.
- the unique identifier is then used to determine an internet protocol address for a stateful host associated with the client device. Once the internet protocol address for the stateful host is known, the communication session is established between the client and the stateful host using the unique identifier, the client identification token and the client authorization token.
- Embodiments of the present disclosure also describe a computer-readable storage medium comprising computer-executable instructions which, when executed by a processor, performs a method for establishing a communication session between a client and a stateful host.
- This method includes generating an authorization token that includes a unique identifier associated with the client. The unique identifier is used to instantiate the stateful host on a virtual machine. An internet protocol address associated with the stateful host is determined and associated with the unique identifier to create a name-value pair. The name-value pair may then be used to establish the communication session between the client and the stateful host.
- FIG. 1 illustrates various components of an example system for establishing a secure communication session between a client device and a stateful backend server.
- FIG. 2 illustrates additional components of the example system shown in FIG. 1 for establishing the secure communication session between the client device and the stateful backend server.
- FIG. 3 illustrates additional components of the example system shown in FIG. 2 for establishing the secure communication session between the client device and the stateful backend server.
- FIG. 4 illustrates a routing path between the client device and the stateful backend server.
- FIG. 5 illustrates a method for establishing a communication session between a client device and a stateful host.
- FIG. 6 illustrates another method for establishing a communication session between a client device and a stateful host.
- FIG. 7 illustrates example physical components of an electronic device with which aspects of the disclosure may be practiced.
- FIG. 8A illustrates an example electronic device with which aspects of the present disclosure may be practiced.
- FIG. 8B is a block diagram that illustrates example components of the electronic device of FIG. 8 A.
- FIG. 9 is a block diagram of a distributed computing system in which aspects of the present disclosure may be practiced.
- FIG. 10 illustrates another example electronic device for executing one or more aspects of the present disclosure.
- Embodiments of the present disclosure are directed to establishing a secure communication session between a client device and a stateful backend server or host.
- the stateful host is associated with a cloud service that enables the client device to access the service via a webpage or application executing on the client device.
- the client device may provide a webpage to a user that enables the user to access the cloud and generate content.
- This content may include, but is not limited to, documents, applications, video content, picture content and so on.
- the stateful host is a virtual server that enables the client device to create an application, such as, for example, a POWERAPPS application by MICROSOFT Corp. of Redmond WA.
- the backend server or host is stateful. As such, it maintains its own state, and also maintains the current state (or last known state) of any content (e.g., an application, document and so on) that it hosts. This helps ensure that the content behaves in a uniform manner each time it is accessed by the client device or any other client device associated with the user that created, edited or otherwise accessed the content.
- any content e.g., an application, document and so on
- embodiments of the present disclosure describe creation of a unique identifier that is used to create a one-to-one relationship between a client device and a stateful host.
- the unique identifier is generated based, at least in part, on an identification credentials and authorization credentials associated with a user of the client device.
- the unique identifier may be sent to and stored by the client device.
- Other components of the system may also use the unique identifier to spawn or otherwise create an instance of the stateful host on a virtual machine.
- the internet protocol address along with the port associated with the stateful host, is determined.
- the internet protocol address and port are associated with the unique identifier to create a name-value pair.
- the name-value pair is stored in a system storage that is accessible by the various components of the system.
- the client device When the client device seeks to establish, or reestablish, a connection with the stateful host, the client device provides the unique identifier to a gateway server.
- the gateway server uses the unique identifier to look up the name-value pair stored in the system storage. Using the unique identifier, the gateway server determines the internet protocol address and port that the client device should be routed to in order to access the stateful host.
- the gateway server may also instruct a backend service to instantiate the stateful host if it is not currently active.
- the gateway server may also instruct the backend service, upon the request of the client, to load the last known or most recent state of the content.
- FIGs. 1-4 illustrate an example system 100 that enables a client device 105 to establish a secure communication session with a stateful host. For purposes of clarity, each of FIGs. 1-4 illustrate additional components of the system 100 as they are needed to establish the secure communication session between the client and the stateful host.
- the system 100 may be accessed by a client device 105.
- the client device 105 may enable a user to create, edit, store or otherwise access content stored on the cloud or otherwise hosted by a cloud service. This is referred to herein as an authoring session.
- the client device 105 may send an access request 110, over a network or internet connection, to a gateway 115.
- the user of the client device 105 may access a webpage displayed on the client device 105 and request that the gateway 115 create an authoring session.
- the gateway 115 may be a publically visible server device that is used to route requests from the client device 105 to an appropriate stateful host or other backend service such as will be described below.
- the client device 105 may be any computing device capable of creating, accessing, editing or otherwise generating content.
- the client device 105 may be a desktop computer, a laptop computer, a tablet computing device, a mobile phone, a personal digital assistant or other such portable computing device.
- a single client device 105 is shown, multiple client devices may access the system 100.
- a single user may have access to multiple client devices 105.
- the embodiments described herein enable the user to access the same stateful host or backend server, and thus the most recent state of the content hosted by the stateful host, regardless of which client device 105 is used to request the authoring session.
- the client device 105 When requesting the authoring session, the client device 105 sends an access request 110 to the gateway 115. Once the access request 110 is processed, the gateway 115 returns a response 112 to the client device 105.
- the response 112 may include a request that the client device 105, and/or the user of the client device 105, be authenticated.
- the client device 105 submits credentials 120, such as, for example, a username and password associated with a user of the client device 105, to an authentication service 125.
- the authentication service 125 uses the credentials 120 to generate an identity token 130.
- the identity token 130 is then communicated to the client device 105.
- the authentication service 125 is a multi-tenant cloud based directory and identity management service that is used to authenticate a variety of different client devices 105. Although shown as a separate component in the system 100, the authentication service 125 may be part of or otherwise associated with the gateway 115. In other implementations, the authentication service 125 may be a stand-alone service.
- the client device 105 sends another access request 110, including the identity token 130, to the gateway 115 and requests creation of the authoring session or otherwise requests access to the cloud.
- the gateway 115 sends another response 112 that requires the client device 105 to verify its authorization or otherwise obtain authorization to access the cloud.
- the client device 105 provides the identity token 130 (also referred to as an authentication token) to an authorization service 135.
- the client device 105 may also include a request for specific resources and specific access to those resources.
- the request may include a request for editing and/or creation privileges for content stored in the cloud.
- the authorization service 135 may determine, using the identity token 130, whether the client device 105 is authorized to access the content in the cloud. In some embodiments, an authorization server associated with the authorization service 135 may be used to verify whether the client device 105 is authorized to access the cloud and what, if any, editing privileges the client device 105 has. If the client device 105 is authorized, the authorization service 135 may generate an authorization token 140 for the client device 105. In some embodiments, the authorization token 140 includes a unique identifier 142 (shown in FIG. 2) that will subsequently be used to create a one-to-one mapping between the client device 105 and a stateful host hosted on the cloud or otherwise provided by a cloud service.
- a unique identifier 142 shown in FIG. 2
- the client device each time the client device accesses the content in the cloud, the client device is routed to the same stateful host or an instantiation of the stateful host. Because the client device 105 essentially accesses the same stateful host each time the content is accessed, the content behaves in a uniform manner.
- the unique identifier 142 may also be associated with the identity token 130. As such, a single user that has access to a number of different client devices 105 may use the identity token 130 to generate a similar authorization token 140 and unique identifier 142. This enables the user to access the content hosted by the stateful host, and also enables the creation of a new instance of the stateful host when required, regardless of the client device 105 being used by the user.
- the authorization token 140 is encrypted or otherwise signed by a security certificate.
- the encryption helps ensure that the authorization token 140 and its associated unique identifier 142, are readable by other components in the system 100 but are not be tampered with or otherwise changed.
- the encrypted authorization token 140 is then provided to the client device 105.
- the client device 105 may store the authorization token 140, the identity token 130 and/or the unique identifier 142 in a persistent storage device. As will be explained in greater detail below, if a connection to the stateful host is lost, the unique identifier 142 may be used to reestablish a secure communication session between the client device 105 and the stateful host.
- the client device 105 may use the authorization token 140, the unique identifier and the identity token 130 to access the cloud.
- the client device 105 may submit a third access request 110, along with its tokens, to the gateway 115.
- the third access request 110 may include a request to begin an authoring session on the cloud.
- the request 110 may request that a stateful host be generated by a virtual machine which may enable the client device 105 to generate or otherwise access content stored on the cloud.
- the figures show a single access request 110 and a single response 112, it should be understood that the access request 110 and the response 112 may include the various requests and responses described herein.
- the gateway 115 provides the unique identifier 142 to an instruction queue 145.
- the instruction queue 145 may be a globally readable storage device that stores a variety of unique identifiers 142 and well as other instructions for the various components of the system 100.
- the system 100 also includes a host creation component 150.
- the host creation component 150 is configured to periodically check the instruction queue 145 to determine if new instructions and/or unique identifiers 142 have been added. In this example, when the host creation component 150 sees that the newly added unique identifier 142 is stored in the instruction queue 145, the host creation component 150 determines that a new stateful host should be instantiated for the client device 105.
- the host creation component 150 spawns or otherwise instantiates a stateful host 155. This is shown in FIG. 3.
- the stateful host 155 is created on a virtual machine. As suggested by the name, the stateful host 155 is a stateful device that tracks or otherwise saves the state of the authoring session between the client device 105 and the stateful host 155. The stateful host 155 may also store or otherwise track the current state of any and all content created on, stored by or otherwise hosted by the stateful host 155.
- the host creation component 150 determines the internet protocol address 160 and the port of the stateful host 155. The host creation component 150 may also verify that the stateful host 155 is functioning properly (e.g., broadcasting its internet protocol address 160 and port). The host creation component 150 generates a name-value pair 165 that is used to identify or is otherwise associated with the stateful host 155. In some embodiments, the name-value pair 165 includes the internet protocol address 160 (and optionally the port) of the stateful host 155 and the unique identifier 142. The name-value pair 165 is then provided to, and stored by, a system storage 170.
- the name-value pair 165 is used to create a one-to-one mapping between the client device 105 and the stateful host 155.
- the client device 105 accesses the cloud, the client device 105 is routed to the same stateful host 155 or an instance of the stateful host 155.
- the system storage 170 is a cache, such as, for example, an Azure Redis Cache by MICROSOFT Corp. of Redmond, WA, although other storage devices and caches may be used.
- the system storage 170 is only visible to the various components of the system 100. For example and as shown in FIG. 3, the system storage 170 may be accessed by the host creation component 150 and the gateway 115.
- the client device 105 may access it. For example, the client device 105 may send an access request 110, including for example, the unique identifier 142 (and in some implementations, the authorization token 140 and the identity token 130) to the gateway 115.
- the gateway 115 verifies that the client device 105 is still authorized and authenticated and relays the unique identifier 142 to the system storage 170.
- the system storage 170 uses the unique identifier 142 to determine the name- value pair 165 it is associated with. Once found, the name-value pair 165 is sent back to the gateway 115.
- the name-value pair 165 includes the internet protocol address 160 (and optionally the port) of the stateful host 155 that was created for the authoring session requested by the client device 105.
- the gateway 115 uses the internet protocol address 160 associated with the unique identifier 142 to route the client device 105 to the stateful host 155 using or otherwise broadcasting the internet protocol address 160 and port. Once connected, the client device 105 may edit content hosted by the stateful host 155.
- the system 100 may also be configured to recover from various unexpected events. These events include, but are not limited to, recovering from and reestablishing the secure communication session between the client device 105 and the stateful host 155 if the client device 105 crashes or otherwise ceases to function, recovering from and reestablishing the secure communication session between the client device 105 and the stateful host 155 if the stateful host 155 crashes or otherwise ceases to function, and recovering from and reestablishing the secure communication session between the client device 105 and the stateful host 155 if the gateway 115 crashes or if the network connection between the client device 105 and the stateful host 155 is severed.
- events include, but are not limited to, recovering from and reestablishing the secure communication session between the client device 105 and the stateful host 155 if the client device 105 crashes or otherwise ceases to function, recovering from and reestablishing the secure communication session between the client device 105 and the stateful host 155 if the stateful host 155 crashes or otherwise ceases to function, and recovering from and reestablishing the secure communication session
- the stateful host 155 may remain active for a predetermined period of time (e.g., 2 hours although other time periods are contemplated). During this time, the stateful host 155 may broadcast its port and/or internet protocol address 160 and wait for the client device 105 to reconnect.
- the client device 105 accesses the authorization token 140, and more specifically, the unique identifier 142 stored in its persistent storage (such as described above).
- the unique identifier 142 is sent to the gateway 115.
- the gateway 115 accesses the system storage 170 and uses the unique identifier 142 to determine the internet protocol address 160 associated with the unique identifier 142.
- the gateway 115 then routes the client device 105 to that particular internet protocol address 160 and reestablishes the communication session with the stateful host 155.
- the stateful host 155 is configured to auto save the content it hosts after a predetermined amount of time. For example, the stateful host 155 may auto save content every thirty seconds although other time periods may be used. This auto save feature may be used to help the stateful host 155 recover if it crashes.
- the gateway 115 may be aware of the crash, even if the client device 105 is not. In response to determining that the stateful host 155 has crashed, the gateway 115 automatically starts a sequence to create a new instance of the stateful host 155 using the unique identifier 142. This sequence is similar to the sequence described above.
- the gateway 115 determines that the stateful host 155 has crashed, the gateway 115 sends the unique identifier 142 to the instruction queue 145. Once the host creation component 150 sees the unique identifier 142 in the instruction queue, it generates a new instance of the stateful host 155. This new instance of the stateful host 155 has the same properties, port and internet protocol address 160 of the previous stateful host 155.
- the host creation component 150 may also cause the new instance of the stateful host 155 to load the last known state of the content the previous stateful host (e.g., the stateful host that crashed) was hosting.
- the instructions to load the last known state of the content may be provided to the new instantiation of the stateful host 155 by the host creation component 150 or it may be provide to the new instantiation of the stateful host 155 directly by the gateway 115.
- the gateway 115 may route the client device 105 to the new instantiation of the stateful host 155 using the internet protocol address 160 and the associated port.
- the client device 105 may use another server to access the stateful host 155 so long as the new server has access to the system storage 170. If so, the client device 105 provides the unique identifier 142 to the new server which accesses the system storage 170 to find the appropriate internet protocol address of the stateful host 155 such as described above. The new server then routes the client device 105 to the stateful host 155.
- FIG. 5 illustrates a method 500 for establishing a secure communication session between a client device and a stateful host.
- the method 500 may be used by the system 100 shown in FIGs. 1-4 to enable the client device 105 to establish an authoring session with a stateful host 155. As such, reference may be made to similar components of the system 100 described above.
- Method 500 begins at operation 510 in which an identity token associated with a client device (e.g., client device 105 (FIG. 1)) is provided to an authorization service.
- a client device e.g., client device 105 (FIG. 1)
- the client device seeks to start an authoring session on the cloud
- the client device sends a cloud access request to a server (e.g., gateway 115 (FIG. 1)).
- the server may require that the client device verify its authorization to access the cloud and/or edit the hosted content.
- the client device submits its identification token to an authorization service.
- the authorization service may use the identification token to ensure that the client device is indeed authorized to access and edit content on the cloud.
- the authorization service generates an authorization token for the client device.
- the authorization token includes a globally unique identifier that may subsequently be used to create a one-to-one mapping between the client device and an instantiated stateful host.
- the authorization service may also be configured to sign the authorization token with a security certificate to encrypt the authorization token.
- the client device may submit the authorization token, including the globally unique identifier (and optionally the identification token) to the server.
- the server then sends 540 the globally unique identifier associated with the authorization token to an instruction queue.
- the instruction queue may be a storage device that is readable by other components of the system.
- a host creation component uses the globally unique identifier to instantiate 550 a stateful host.
- the host creation component may monitor the instruction queue for newly added globally unique identifiers and/or associated instructions to instantiate new stateful hosts.
- the host creation component spawns a stateful host.
- the stateful host is spawned or otherwise generated on a virtual machine or server.
- the host creation component may also be configured to determine the internet protocol address and the port of the stateful host. The host creation component then associates the globally unique identifier with the internet protocol address to generate 560 a name-value pair. [0065] Flow then proceeds to operation 570 and the name-value pair is securely stored in a system storage.
- the secure system storage is a cache, such as, for example, a Redis Cache or other type of cache or storage device hosted by a cloud servicer or otherwise accessible in the cloud.
- the globally unique identifier may be used to determine the internet protocol address of the stateful host such that there is a one-to-one mapping between the client device and the stateful host.
- FIG. 6 illustrates another method 600 for establishing a communication session between a client device and a stateful host.
- the method 600 may be a continuation of the method 500 of FIG. 5.
- the method 600 may be used by a client device to reestablish a connection with the stateful host or to cause a new instantiation of the stateful host.
- Method 600 begins at operation 610 in which an authorization token, including a globally unique identifier (and optionally an identity token) is provided to a server.
- an authorization token including a globally unique identifier (and optionally an identity token) is provided to a server.
- a client device stores the authorization token and the associated globally unique identifier in a persistent storage. As such, the client device may send this information to the server in order to start or reestablish an authoring session on a stateful host.
- the server retrieves a name-value pair associated with the globally unique identifier from a system storage.
- the name-value pair includes the internet protocol address and port information associated with the stateful host that was generated to service this particular client device.
- the system storage may also include other information about previously established authoring sessions between the client device and the stateful host.
- the stateful host 155 may no longer be active when the client device seeks to reestablish the communication session.
- the server may transmit the globally unique identifier to an instruction queue.
- the host creation component When a host creation component sees that the globally unique identifier has been added to the instruction queue, the host creation component generates a new instance of the stateful host.
- the host creation component 150 may access the system storage to determine the internet protocol address of the previous instantiation of the stateful host and reuse the internet protocol address. The server may then route the client device to the newly created instance such as described above.
- the stateful host may be configured to auto save the content at various time intervals.
- the stateful host may also store additional information about the established session. Thus, when the client device subsequently reestablishes a connection to the stateful host or a new instantiation of the stateful host is generated, the new authoring session may commence where the old authoring session terminated.
- FIGs. 7-10 and the associated descriptions provide a discussion of a variety of operating environments in which aspects of the disclosure may be practiced.
- the devices and systems illustrated and discussed with respect to FIGs. 7-10 are for purposes of example and illustration and are not limiting of a vast number of electronic device configurations that may be utilized for practicing aspects of the disclosure, as described herein.
- FIG. 7 is a block diagram illustrating physical components (e.g., hardware) of an electronic device 700 with which aspects of the disclosure may be practiced.
- the components of the electronic device 700 described below may have computer executable instructions for establishing a secure communication session with a stateful host such as described above.
- the electronic device 700 may include at least one processing unit 710 and a system memory 715.
- the system memory 715 may comprise, but is not limited to, volatile storage (e.g., random access memory), non-volatile storage (e.g., read-only memory), flash memory, or any combination of such memories.
- the system memory 715 may include an operating system 725 and one or more program modules 720.
- the program modules 720 may include token modules 705 that are used to generate or otherwise store the various tokens and identifiers described above.
- the operating system 725 may be suitable for controlling the operation of the electronic device 700.
- embodiments of the disclosure may be practiced in conjunction with a graphics library, other operating systems, or any other application program and is not limited to any particular application or system. This basic configuration is illustrated in FIG. 7 by those components within a dashed line 730.
- the electronic device 700 may have additional features or functionality.
- the electronic device 700 may also include additional data storage devices (removable and/or non-removable) such as, for example, magnetic disks, optical disks, or tape.
- additional storage is illustrated in FIG. 7 by a removable storage device 735 and a non-removable storage device 740.
- program modules 720 may perform processes including, but not limited to, the aspects, as described herein.
- embodiments of the disclosure may be practiced in an electrical circuit comprising discrete electronic elements, packaged or integrated electronic chips containing logic gates, a circuit utilizing a microprocessor, or on a single chip containing electronic elements or microprocessors.
- embodiments of the disclosure may be practiced via a system-on-a-chip (SOC) where each or many of the components illustrated in FIG. 7 may be integrated onto a single integrated circuit.
- SOC system-on-a-chip
- Such an SOC device may include one or more processing units, graphics units, communications units, system virtualization units and various application functionality all of which are integrated (or "burned") onto the chip substrate as a single integrated circuit.
- the functionality, described herein, with respect to the capability of client to switch protocols may be operated via application-specific logic integrated with other components of the electronic device 700 on the single integrated circuit (chip).
- Embodiments of the disclosure may also be practiced using other technologies capable of performing logical operations such as, for example, AND, OR, and NOT, including but not limited to mechanical, optical, fluidic, and quantum technologies.
- embodiments of the disclosure may be practiced within a general purpose computer or in any other circuits or systems.
- the electronic device 700 may also have one or more input device(s) 745 such as a keyboard, a trackpad, a mouse, a pen, a sound or voice input device, a touch, force and/or swipe input device, etc.
- the output device(s) 750 such as a display, speakers, a printer, etc. may also be included.
- the aforementioned devices are examples and others may be used.
- the electronic device 700 may include one or more communication connections 755 allowing communications with other electronic devices 760. Examples of suitable communication connections 755 include, but are not limited to, radio frequency (RF) transmitter, receiver, and/or transceiver circuitry; universal serial bus (USB), parallel, and/or serial ports.
- RF radio frequency
- USB universal serial bus
- Computer-readable media may include computer storage media.
- Computer storage media may include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information, such as computer readable instructions, data structures, or program modules.
- the system memory 715, the removable storage device 735, and the nonremovable storage device 740 are all computer storage media examples (e.g., memory storage).
- Computer storage media may include RAM, ROM, electrically erasable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other article of manufacture which can be used to store information and which can be accessed by the electronic device 700. Any such computer storage media may be part of the electronic device 700.
- Computer storage media does not include a carrier wave or other propagated or modulated data signal.
- Communication media may be embodied by computer readable instructions, data structures, program modules, or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and includes any information delivery media.
- modulated data signal may describe a signal that has one or more characteristics set or changed in such a manner as to encode information in the signal.
- communication media may include wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, radio frequency (RF), infrared, and other wireless media.
- RF radio frequency
- FIGs. 8A and 8B illustrate a mobile electronic device 800, for example, a mobile telephone, a smart phone, wearable computer (such as a smart watch), a tablet computer, a laptop computer, and the like, with which embodiments of the disclosure may be practiced.
- a mobile electronic device 800 for example, a mobile telephone, a smart phone, wearable computer (such as a smart watch), a tablet computer, a laptop computer, and the like, with which embodiments of the disclosure may be practiced.
- wearable computer such as a smart watch
- a tablet computer such as a smart watch
- laptop computer a laptop computer
- the mobile electronic device 800 is a handheld computer having both input elements and output elements.
- the mobile electronic device 800 typically includes a display 805 and one or more input buttons 810 that allow the user to enter information into the mobile electronic device 800.
- the display 805 of the mobile electronic device 800 may also function as an input device (e.g., a display that accepts touch and/or force input).
- an optional side input element 815 allows further user input.
- the side input element 815 may be a rotary switch, a button, or any other type of manual input element.
- mobile electronic device 800 may incorporate more or less input elements.
- the display 805 may not be a touch screen in some embodiments.
- the mobile electronic device 800 is a portable phone system, such as a cellular phone.
- the mobile electronic device 800 may also include an optional keypad 835.
- Optional keypad 835 may be a physical keypad or a "soft" keypad generated on the touch screen display.
- the output elements include the display 805 for showing a graphical user interface (GUI), a visual indicator 820 (e.g., a light emitting diode), and/or an audio transducer 825 (e.g., a speaker).
- GUI graphical user interface
- the mobile electronic device 800 incorporates a vibration transducer for providing the user with tactile feedback.
- the mobile electronic device 800 incorporates input and/or output ports, such as an audio input (e.g., a microphone jack), an audio output (e.g., a headphone jack), and a video output (e.g., a HDMI port) for sending signals to or receiving signals from an external device.
- FIG. 8B is a block diagram illustrating the architecture of one aspect of a mobile electronic device 800. That is, the mobile electronic device 800 can incorporate a system (e.g., an architecture) 840 to implement some aspects.
- the system 840 is implemented as a "smart phone" capable of running one or more applications (e.g., browser, e-mail, calendaring, contact managers, messaging clients, games, media clients/players, content selection and sharing applications and so on).
- the system 840 is integrated as an electronic device, such as an integrated personal digital assistant (PDA) and wireless phone.
- PDA personal digital assistant
- One or more application programs 850 may be loaded into the memory 845 and run on or in association with the operating system 855.
- Examples of the application programs include phone dialer programs, e-mail programs, personal information management (PIM) programs, word processing programs, spreadsheet programs, Internet browser programs, messaging programs, and so forth.
- PIM personal information management
- the system 840 also includes a non-volatile storage area 860 within the memory 845.
- the non-volatile storage area 860 may be used to store persistent information (such as, for example, the authorization token, the identity token and/or the globally unique identifier) that should not be lost if the system 840 is powered down.
- the application programs 850 may use and store information in the nonvolatile storage area 860, such as email or other messages used by an email application, and the like.
- a synchronization application (not shown) also resides on the system 840 and is programmed to interact with a corresponding synchronization application resident on a host computer to keep the information stored in the non-volatile storage area 860 synchronized with corresponding information stored at the host computer.
- the system 840 has a power supply 865, which may be implemented as one or more batteries.
- the power supply 865 may further include an external power source, such as an AC adapter or a powered docking cradle that supplements or recharges the batteries.
- the system 840 may also include a radio interface layer 870 that performs the function of transmitting and receiving radio frequency communications.
- the radio interface layer 870 facilitates wireless connectivity between the system 840 and the "outside world," via a communications carrier or service provider. Transmissions to and from the radio interface layer 870 are conducted under control of the operating system 855. In other words, communications received by the radio interface layer 870 may be disseminated to the application programs 850 via the operating system 855, and vice versa.
- the visual indicator 820 may be used to provide visual notifications, and/or an audio interface 875 may be used for producing audible notifications via an audio transducer (e.g., audio transducer 825 illustrated in FIG. 8A).
- the visual indicator 820 is a light emitting diode (LED) and the audio transducer 825 may be a speaker.
- LED light emitting diode
- the LED may be programmed to remain on indefinitely until the user takes action to indicate the powered-on status of the device.
- the audio interface 875 is used to provide audible signals to and receive audible signals from the user.
- the audio interface 875 may also be coupled to a microphone to receive audible input, such as to facilitate a telephone conversation.
- the microphone may also serve as an audio sensor to facilitate control of notifications, as will be described below.
- the system 840 may further include a video interface 880 that enables an operation of peripheral device 830 (e.g., on-board camera) to record still images, video stream, and the like.
- peripheral device 830 e.g., on-board camera
- a mobile electronic device 800 implementing the system 840 may have additional features or functionality.
- the mobile electronic device 800 may also include additional data storage devices (removable and/or non-removable) such as, magnetic disks, optical disks, or tape.
- additional storage is illustrated in FIG. 8B by the non-volatile storage area 860.
- Data/information generated or captured by the mobile electronic device 800 and stored via the system 840 may be stored locally on the mobile electronic device 800, as described above, or the data may be stored on any number of storage media that may be accessed by the device via the radio interface layer 870 or via a wired connection between the mobile electronic device 800 and a separate electronic device associated with the mobile electronic device 800, for example, a server computer in a distributed computing network, such as the Internet.
- a server computer in a distributed computing network such as the Internet.
- data/information may be accessed via the mobile electronic device 800 via the radio interface layer 870 or via a distributed computing network.
- data/information may be readily transferred between electronic devices for storage and use according to well-known data/information transfer and storage means, including electronic mail and collaborative data/information sharing systems.
- FIG. 8A and FIG. 8B are described for purposes of illustrating the present methods and systems and is not intended to limit the disclosure to a particular sequence of steps or a particular combination of hardware or software components.
- FIG. 9 illustrates one aspect of the architecture of a system 900 for establishing a communication session between a client device and a backend server 905.
- the client device may be a general computing device 910 (e.g., personal computer), tablet computing device 915, or mobile computing device 920.
- Each of these devices may store the various tokens 925 described above.
- these tokens 925 include an authorization token, an identity token and a globally unique identifier that assist the client device in establishing an authoring session with a stateful host or other cloud service.
- Various other types on content associated with the client device may be stored by or transmitted to a directory service 945, a web portal 950, mailbox services 955, instant messaging stores 960, or social networking services 965.
- the client devices may communicate the tokens with to the server 905.
- the general computing device 910, the tablet computing device 915 and/or the mobile computing device 920 may send these tokens to the server 905 through a network 930.
- FIG. 9 is described for purposes of illustrating the present methods and systems and is not intended to limit the disclosure to a particular sequence of steps or a particular combination of hardware or software components.
- FIG. 10 illustrates an example tablet electronic device 1000 that may execute one or more aspects disclosed herein.
- the aspects and functionalities described herein may operate over distributed systems (e.g., cloud-based computing systems), where application functionality, memory, data storage and retrieval and various processing functions may be operated remotely from each other over a distributed computing network, such as the Internet or an intranet.
- distributed systems e.g., cloud-based computing systems
- application functionality, memory, data storage and retrieval and various processing functions may be operated remotely from each other over a distributed computing network, such as the Internet or an intranet.
- User interfaces and information of various types may be displayed via on-board electronic device displays or via remote display units associated with one or more electronic devices.
- user interfaces and information of various types may be displayed and interacted with on a wall surface onto which user interfaces and information of various types are projected.
- Interaction with the multitude of computing systems with which embodiments of the invention may be practiced include, keystroke entry, touch screen entry, voice or other audio entry, gesture entry where an associated electronic device is equipped with detection (e.g., camera) functionality for capturing and interpreting user gestures for controlling the functionality of the electronic device, and the like.
- detection e.g., camera
- FIG. 10 is described for purposes of illustrating the present methods and systems and is not intended to limit the disclosure to a particular sequence of steps or a particular combination of hardware or software components.
- the present disclosure describes a method for establishing a communication session between a client device and a stateful host, comprising: providing an identity token to an authorization service; determining, using the identity token, whether the client device is authorized to establish an authoring session with the stateful host hosted by a cloud service; when it is determined that the client device is authorized to establish the authoring session, generating an authorization token that includes a unique identifier associated with the client device; generating a stateful host on a virtual machine; associating the unique identifier with the stateful host; determining an internet protocol address associated with the stateful host; associating the internet protocol address with the unique identifier to create a name-value pair; securely storing the name-value pair in the cloud service; and using the name-value pair to establish the communication session between the client device and the stateful host.
- the authorization token and the unique identifier are provided to the client device.
- the client device provides the unique identifier to a gateway to establish a subsequent secure communication session with the stateful host.
- the unique identifier is used to determine the name-value pair associated with the stateful host.
- the authorization token is encrypted.
- the unique identifier is used to create a one-to-one mapping between the client device and the stateful host.
- the name-value pair is stored in a secure global storage device.
- using the unique identifier to determine an internet protocol address comprises accessing a storage cache that stores name-value pairs comprising a plurality of unique identifiers and a plurality of internet protocol addresses.
- the stateful host is instantiated by a virtual machine.
- the system further comprises instructions for reestablishing a connection between the client device and the stateful host when a connection between the client device and the stateful host is lost, wherein the connection is reestablished by using the unique identifier to determine the internet protocol address for the stateful host.
- the system comprises instructions for determining whether the stateful host is inactive.
- system comprises instructions for causing a virtual machine to create a new instantiation of the stateful host when it is determined the stateful host is inactive.
- system comprises instructions for loading a last known state of the content hosted by the stateful host using, at least, the unique identifier.
- Additional aspects disclosed herein describe a computer-readable storage medium comprising computer-executable instructions which, when executed by a processor, performs a method for establishing a communication session between a client and a stateful host, comprising: generating an authorization token that includes a unique identifier associated with the client; using the unique identifier to instantiate the stateful host on a virtual machine; determining an internet protocol address associated with the stateful host; associating the internet protocol address with the unique identifier to create a name- value pair; and using the name-value pair to establish the communication session between the client and the stateful host.
- the computer-readable storage medium further comprises instructions for providing the unique identifier to the client.
- the computer-readable storage medium further comprises instructions for determining whether the stateful host is inactive. In further examples, the computer-readable storage medium further comprises instructions for determining a last known state of the stateful host using the unique identifier when a connection to the stateful host is reestablished. In further examples, the computer-readable storage medium further comprises instructions for associating the authorization token with an authentication token associated with the client. In further examples, the computer-readable storage medium further comprises receiving the authorization token, the authentication token and the unique identifier when the client seeks to reestablish a connection with the stateful host.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Signal Processing (AREA)
- Computer Networks & Wireless Communication (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Computing Systems (AREA)
- Theoretical Computer Science (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Computer And Data Communications (AREA)
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201780064542.7A CN109906453B (zh) | 2016-10-19 | 2017-10-12 | 建立用于有状态云服务的安全会话的方法、系统 |
EP17788063.0A EP3529730B1 (en) | 2016-10-19 | 2017-10-12 | Establishing secure sessions for stateful cloud services |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US15/298,044 US10686886B2 (en) | 2016-10-19 | 2016-10-19 | Establishing secure sessions for stateful cloud services |
US15/298,044 | 2016-10-19 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2018075317A1 true WO2018075317A1 (en) | 2018-04-26 |
Family
ID=60162313
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/US2017/056239 WO2018075317A1 (en) | 2016-10-19 | 2017-10-12 | Establishing secure sessions for stateful cloud services |
Country Status (4)
Country | Link |
---|---|
US (1) | US10686886B2 (zh) |
EP (1) | EP3529730B1 (zh) |
CN (1) | CN109906453B (zh) |
WO (1) | WO2018075317A1 (zh) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP4199563A4 (en) * | 2020-09-14 | 2024-01-24 | Huawei Tech Co Ltd | METHOD AND APPARATUS FOR ASSOCIATION BETWEEN COMMUNICATION DEVICES |
Families Citing this family (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN112532599B (zh) * | 2020-11-19 | 2023-04-18 | 北京信安世纪科技股份有限公司 | 一种动态鉴权方法、装置、电子设备和存储介质 |
US11818102B2 (en) * | 2021-04-16 | 2023-11-14 | Nokia Technologies Oy | Security enhancement on inter-network communication |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20080034198A1 (en) * | 2006-08-03 | 2008-02-07 | Junxiao He | Systems and methods for using a client agent to manage http authentication cookies |
US7870389B1 (en) * | 2002-12-24 | 2011-01-11 | Cisco Technology, Inc. | Methods and apparatus for authenticating mobility entities using kerberos |
US20160134616A1 (en) * | 2014-11-10 | 2016-05-12 | Amazon Technologies, Inc. | Desktop application fulfillment platform with multiple authentication mechanisms |
Family Cites Families (32)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
FR1265242A (fr) | 1960-05-17 | 1961-06-30 | Csf | Perfectionnements aux convertisseurs thermoélectroniques d'énergie thermique en énergie électrique, notamment aux structures de leurs électrodes |
US3219609A (en) | 1961-02-22 | 1965-11-23 | Kuhlmann Ets | Aqueous dispersions of vinyl chloride-acrylic ester copolymers |
FR1525343A (fr) | 1967-04-06 | 1968-05-17 | Machine-outil perfectionnée | |
US3447881A (en) | 1967-10-26 | 1969-06-03 | Us Navy | Flame-coloring device |
US5907621A (en) * | 1996-11-15 | 1999-05-25 | International Business Machines Corporation | System and method for session management |
NL1018494C2 (nl) * | 2001-07-09 | 2003-01-10 | Koninkl Kpn Nv | Methode en systeem voor het door een dienstproces aan een client leveren van een dienst. |
EP1568189B1 (en) | 2002-12-02 | 2015-06-17 | Sap Se | Session-return enabling stateful web applications |
GB2442044B8 (en) * | 2006-05-11 | 2011-02-23 | Ericsson Telefon Ab L M | Addressing and routing mechanism for web server clusters. |
US8775544B2 (en) * | 2009-02-04 | 2014-07-08 | Citrix Systems, Inc. | Methods and systems for dynamically switching between communications protocols |
CA2751554C (en) | 2009-02-05 | 2015-07-21 | Wwpass Corporation | Centralized authentication system with safe private data storage and method |
US8689213B2 (en) * | 2009-12-14 | 2014-04-01 | Citrix Systems, Inc. | Methods and systems for communicating between trusted and non-trusted virtual machines |
US8984621B2 (en) * | 2010-02-27 | 2015-03-17 | Novell, Inc. | Techniques for secure access management in virtual environments |
US8725880B2 (en) * | 2010-04-07 | 2014-05-13 | Apple, Inc. | Establishing online communication sessions between client computing devices |
US8607054B2 (en) * | 2010-10-15 | 2013-12-10 | Microsoft Corporation | Remote access to hosted virtual machines by enterprise users |
US9465589B2 (en) | 2011-04-05 | 2016-10-11 | Microsoft Technology Licensing, Llc | Stateful component authoring and execution |
US9306950B2 (en) * | 2011-05-13 | 2016-04-05 | Telefonaktiebolaget L M Ericsson (Publ) | Methods, server and proxy agent for dynamically setting up a session between a target resource in a private network and an application on a device |
US8769622B2 (en) | 2011-06-30 | 2014-07-01 | International Business Machines Corporation | Authentication and authorization methods for cloud computing security |
US8949938B2 (en) * | 2011-10-27 | 2015-02-03 | Cisco Technology, Inc. | Mechanisms to use network session identifiers for software-as-a-service authentication |
US9027114B2 (en) * | 2013-03-12 | 2015-05-05 | Cisco Technology, Inc. | Changing group member reachability information |
US9294455B2 (en) * | 2013-06-04 | 2016-03-22 | Google Inc. | Maintaining video conference session continuity during transfer of session to alternative device |
US9124569B2 (en) | 2013-06-14 | 2015-09-01 | Microsoft Technology Licensing, Llc | User authentication in a cloud environment |
CN103347085B (zh) | 2013-07-12 | 2016-03-23 | 东南大学 | 云数据安全的多写入模型的公共审计设计方法 |
US9755960B2 (en) | 2013-09-30 | 2017-09-05 | Juniper Networks, Inc. | Session-aware service chaining within computer networks |
IL229907A (en) * | 2013-12-10 | 2015-02-26 | David Almer | Mobile device with enhanced security |
WO2015123319A2 (en) * | 2014-02-11 | 2015-08-20 | Aaron Boodman | Authentication specific data |
US9680821B2 (en) * | 2014-05-28 | 2017-06-13 | Conjur, Inc. | Resource access control for virtual machines |
US9871821B2 (en) * | 2014-11-11 | 2018-01-16 | Oracle International Corporation | Securely operating a process using user-specific and device-specific security constraints |
US10454936B2 (en) * | 2015-10-23 | 2019-10-22 | Oracle International Corporation | Access manager session management strategy |
US20170289185A1 (en) * | 2016-03-31 | 2017-10-05 | Qualcomm Incorporated | Device assisted traffic anomaly detection |
US20170289197A1 (en) * | 2016-03-31 | 2017-10-05 | Qualcomm Incorporated | Transport layer security token binding and trusted signing |
US20170374088A1 (en) * | 2016-06-22 | 2017-12-28 | Sable Networks, Inc. | Individually assigned server alias address for contacting a server |
US10574644B2 (en) * | 2017-05-03 | 2020-02-25 | International Business Machines Corporation | Stateful session manager |
-
2016
- 2016-10-19 US US15/298,044 patent/US10686886B2/en active Active
-
2017
- 2017-10-12 WO PCT/US2017/056239 patent/WO2018075317A1/en unknown
- 2017-10-12 CN CN201780064542.7A patent/CN109906453B/zh active Active
- 2017-10-12 EP EP17788063.0A patent/EP3529730B1/en active Active
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7870389B1 (en) * | 2002-12-24 | 2011-01-11 | Cisco Technology, Inc. | Methods and apparatus for authenticating mobility entities using kerberos |
US20080034198A1 (en) * | 2006-08-03 | 2008-02-07 | Junxiao He | Systems and methods for using a client agent to manage http authentication cookies |
US20160134616A1 (en) * | 2014-11-10 | 2016-05-12 | Amazon Technologies, Inc. | Desktop application fulfillment platform with multiple authentication mechanisms |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP4199563A4 (en) * | 2020-09-14 | 2024-01-24 | Huawei Tech Co Ltd | METHOD AND APPARATUS FOR ASSOCIATION BETWEEN COMMUNICATION DEVICES |
Also Published As
Publication number | Publication date |
---|---|
EP3529730B1 (en) | 2023-12-27 |
CN109906453A (zh) | 2019-06-18 |
EP3529730A1 (en) | 2019-08-28 |
CN109906453B (zh) | 2023-07-25 |
US20180109628A1 (en) | 2018-04-19 |
US10686886B2 (en) | 2020-06-16 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
KR102511811B1 (ko) | 봇 사용자를 안전하게 인증하는 기법 | |
US11088807B2 (en) | Application-level acknowledgements | |
US8612614B2 (en) | Method and system for establishing a dedicated session for a member of a common frame buffer group | |
US20160364200A1 (en) | Remote desktop exporting | |
EP3100431B1 (en) | Tenant based signature validation | |
US20150142982A1 (en) | Preservation of connection session | |
US11456872B2 (en) | Offline protection of secrets | |
US9246949B2 (en) | Secure capability negotiation between a client and server | |
EP3529730B1 (en) | Establishing secure sessions for stateful cloud services | |
US11523260B2 (en) | Delivery of configuration information for cross-platform application integration | |
US20170126844A1 (en) | Server architecture and protocol development | |
US10715494B2 (en) | Orchestrating work across domains and work streams | |
US11841928B2 (en) | Secure collaboration messaging | |
CN110968856B (zh) | 登录方法、装置、电子设备和存储介质 | |
EP3008586A1 (en) | Proximity operations for electronic file views | |
US20230195507A1 (en) | Local to remote application switching | |
US20210357598A1 (en) | Input method language determination | |
US20220070123A1 (en) | Identity leak prevention | |
US11704175B2 (en) | Bridging virtual desktops under nested mode | |
US20230409356A1 (en) | Password protection for screen sharing |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 17788063 Country of ref document: EP Kind code of ref document: A1 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
ENP | Entry into the national phase |
Ref document number: 2017788063 Country of ref document: EP Effective date: 20190520 |